NetSight
IP …
medium5.0

CVE-2008-4688

core/string_api.php in Mantis before 1.1.3 does not check the privileges of the viewer before composing a link with issue data in the source anchor, which allo…

Impact

core/string_api.php in Mantis before 1.1.3 does not check the privileges of the viewer before composing a link with issue data in the source anchor, which allows remote attackers to discover an issue's title and status via a request with a modified issue number.

Affected products

VendorProductAffected versions
MantisMantis
through 1.1.3
Versions 0.19.3, 0.19.4, 1.0.1, 1.0.2, 1.0.3

Weakness classification

CWE-200

References